{"id":"CVE-2026-47217","kind":"vulnerability","aliases":["CVE-2026-47217"],"related":[],"title":"BACnet Stack: remote crash via uncontrolled recursion in Channel object","description":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4 and 1.5.1, a remote attacker can trigger an uncontrolled recursion and stack overflow in the default server application of bacnet-stack by abusing the Channel object. This issue has been patched in versions 1.4.4 and 1.5.1.","summary":"BACnet Stack is an open source BACnet protocol library in C used in embedded building-automation devices. A remote attacker can trigger unbounded recursion through the Channel object, overflowing the stack in the default server application.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"bacnet-stack","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["bacnet","c","embedded","package"],"not_affected_if":["bacnet-stack-1.4.4-or-later","bacnet-stack-1.5.1-or-later"],"how_to_check":"- Check the bacnet-stack version in your build, for example `grep -ri bacnet` in your project's dependency or source tree.\n- Confirm whether your server application uses the Channel object.","fix":"- bacnet-stack `1.4.4` on the 1.4 line\n- bacnet-stack `1.5.1` on the 1.5 line","status":"open","published_at":"2026-11-12T20:18:39+00:00","first_seen_at":"2026-11-12T20:40:26+00:00","triaged_at":"2026-11-12T20:42:09+00:00","updated_at":"2026-11-12T20:42:09+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-12T20:42:09Z","model":"claude-haiku-5-5","output":{"fix":"- bacnet-stack `1.4.4` on the 1.4 line\n- bacnet-stack `1.5.1` on the 1.5 line","reach":"network","title":"BACnet Stack: remote crash via uncontrolled recursion in Channel object","impact":"medium","summary":"BACnet Stack is an open source BACnet protocol library in C used in embedded building-automation devices. A remote attacker can trigger unbounded recursion through the Channel object, overflowing the stack in the default server application.","audience":"developers","category":"package","nicknames":[],"who_cares":["bacnet","embedded","c"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"remote attacker crashes the server via stack overflow","analyst_note":"Confirm from the vendor advisory (github.com) whether the Channel object is enabled by default and whether the crash is the only impact.","how_to_check":"- Check the bacnet-stack version in your build, for example `grep -ri bacnet` in your project's dependency or source tree.\n- Confirm whether your server application uses the Channel object.","plain_action":"","product_name":"bacnet-stack","needs_analyst":true,"not_affected_if":["bacnet-stack-1.4.4-or-later","bacnet-stack-1.5.1-or-later"],"who_is_affected":"Teams that build or run applications on bacnet-stack versions before 1.4.4 or 1.5.1 that use the default server application with the Channel object exposed to the network. Systems that do not use the default server application or the Channel object are less exposed, but the sources do not say which configuration is the default for every build. unknown beyond that.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000768,"input_tokens":4582,"output_tokens":620,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-47217':13A,16A '1.4.4':78C,113C '1.5.1':80C,115C 'abus':102C 'applic':60B,96C 'attack':44B,83C 'autom':40B 'bacnet':1A,18A,20B,24B,30B,61C,65C,99C 'bacnet-stack':17A,98C 'build':39B 'building-autom':38B 'c':21B,34B,70C 'channel':9A,51B,104C 'crash':4A 'cve':11A,14A 'default':58B,94C 'devic':41B 'embed':22B,37B,73C 'issu':107C 'librari':32B,71C 'object':10A,52B,105C 'open':28B,66C 'overflow':53B,91C 'packag':23B 'patch':110C 'prior':75C 'protocol':31B,68C 'recurs':7A,48B,88C 'remot':3A,43B,82C 'server':59B,95C 'sourc':29B,67C 'stack':2A,19A,25B,55B,62C,69C,90C,100C 'system':74C 'trigger':46B,85C 'unbound':47B 'uncontrol':6A,87C 'use':35B 'version':77C,112C 'via':5A","nicknames":[],"mitigations":[],"who_affected":"Teams that build or run applications on bacnet-stack versions before 1.4.4 or 1.5.1 that use the default server application with the Channel object exposed to the network. Systems that do not use the default server application or the Channel object are less exposed, but the sources do not say which configuration is the default for every build. unknown beyond that.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["bacnetstack"],"ptokens":["bacnet","stack"],"labels":["bacnet","c","embedded","high","package","vendor"],"campaign_type":null,"search_a":"'-2026':12A,15A '-47217':13A,16A 'bacnet':1A,18A 'bacnet-stack':17A 'channel':9A 'crash':4A 'cve':11A,14A 'object':10A 'recurs':7A 'remot':3A 'stack':2A,19A 'uncontrol':6A 'via':5A","search_b":"'applic':60B 'attack':44B 'autom':40B 'bacnet':20B,24B,30B 'build':39B 'building-autom':38B 'c':21B,34B 'channel':51B 'default':58B 'devic':41B 'embed':22B,37B 'librari':32B 'object':52B 'open':28B 'overflow':53B 'packag':23B 'protocol':31B 'recurs':48B 'remot':43B 'server':59B 'sourc':29B 'stack':25B,55B 'trigger':46B 'unbound':47B 'use':35B","search_c":"'1.4.4':78C,113C '1.5.1':80C,115C 'abus':102C 'applic':96C 'attack':83C 'bacnet':61C,65C,99C 'bacnet-stack':98C 'c':70C 'channel':104C 'default':94C 'embed':73C 'issu':107C 'librari':71C 'object':105C 'open':66C 'overflow':91C 'patch':110C 'prior':75C 'protocol':68C 'recurs':88C 'remot':82C 'server':95C 'sourc':67C 'stack':62C,69C,90C,100C 'system':74C 'trigger':85C 'uncontrol':87C 'version':77C,112C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-05T02:01:55+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-47217","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47217","severity":null,"published_at":"2026-11-12T20:18:39+00:00","modified_at":"2026-11-12T20:18:39+00:00","first_seen_at":"2026-11-12T20:40:26+00:00","fetched_at":"2026-11-12T20:40:26+00:00","note":null}],"documents":[{"id":138282,"url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-wjw5-q9g6-2764","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-05T02:01:55+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}